Device monitoring policy

Abstract

A method and device for generating a monitoring policy for a device and selectively monitoring multiple tasks executed by the device is disclosed. The monitoring policy may relate to security monitoring or resource availability. A monitoring importance score for each of multiple tasks executing on the device may be generated and a monitoring resource availability within the device may be determined. The monitoring policy for the device may be generated based at least in part on the monitoring importance scores for the multiple tasks and the monitoring resource availability within the device. Fewer than all of the multiple tasks may be selectively monitored based on the monitoring policy for security threats to the device or resource availability for the device.

What is claimed is: 
     
       1. A method, comprising:
 determining a plurality of security attributes for each respective task of multiple tasks executing on a device, the plurality of security attributes including an execution duration of the respective task, a security context of the respective task, a permission level for accessing the respective task, and a quantity of interfaces external to the device that interface with the respective task; 
 generating a security monitoring importance score for each respective task of the multiple tasks based on the plurality of security attributes that correspond to the respective task in which each security monitoring importance score indicates a security risk of the respective task to the device; 
 determining an availability of a plurality of monitoring resources within the device that are used in monitoring the multiple tasks for security threats; 
 generating a monitoring policy for the device based at least in part on the security monitoring importance scores for the multiple tasks and the availability of monitoring resources within the device, the monitoring policy dictating selective monitoring of the multiple tasks for security threats according to a prioritization of the multiple tasks that is based on the respective security monitoring importance scores for the respective tasks of the multiple tasks in which the monitoring policy dictates the selective monitoring in response to the availability of monitoring resources of the device being insufficient to monitor all of the multiple tasks executing on the device; and 
 selectively monitoring fewer than all of the multiple tasks executing on the device for security threats according to the prioritization included in the monitoring policy. 
 
     
     
       2. The method of  claim 1 , wherein the generating the security monitoring importance score for each respective task further comprises applying weights to the plurality of attributes. 
     
     
       3. The method of  claim 1 , wherein determining the availability of monitoring resources within the device further comprises determining a quantity of resources of the device. 
     
     
       4. The method of  claim 1 , wherein determining the availability of monitoring resources within the device further comprises analyzing an average load of the resources of the device over a period of time. 
     
     
       5. The method of  claim 1 , wherein the generating the monitoring policy for the device further comprises determining a monitoring threshold for selective monitoring of fewer than all of the multiple tasks in which the monitoring threshold includes a threshold security monitoring importance score. 
     
     
       6. A device, comprising:
 one or more processors; and 
 one or more non-transitory computer-readable media coupled to the one or more processors and including instructions that, in response to execution by the one or more processors, are configured to cause the one or more processors to perform operations, the operations comprising: 
 determining one or more security attributes for each respective task of multiple tasks executing on a device, the one or more security attributes including one or more attributes selected from a group of attributes consisting of: an execution duration of the respective task, a security context of the respective task, a permission level for accessing the respective task, and a quantity of interfaces external to the device that interface with the respective task 
 generating a security monitoring importance score for each respective task of the multiple tasks based on the one or more security attributes that correspond to the respective task in which each security monitoring importance score indicates a security risk of the respective task to the device; 
 determining an availability of a plurality of monitoring resources within the device that are used in monitoring the multiple tasks for security threats; 
 generating a monitoring policy for the device based at least in part on the security monitoring importance scores for the multiple tasks and the availability of monitoring resources within the device, the monitoring policy dictating selective monitoring of the multiple tasks for security threats according to a prioritization of the multiple tasks that is based on the respective security monitoring importance scores for the respective tasks of the multiple tasks in which the monitoring policy dictates the selective monitoring in response to the availability of monitoring resources of the device being insufficient to monitor all of the multiple tasks executing on the device; and 
 selectively monitoring fewer than all of the multiple tasks executing on the device for security threats according to the prioritization included in the monitoring policy. 
 
     
     
       7. The device of  claim 6 , wherein the generating the security monitoring importance score for each respective task further comprises applying weights to the one or more. 
     
     
       8. The device of  claim 6 , wherein determining the availability of monitoring resources within the device further comprises determining a quantity of resources of the device. 
     
     
       9. The device of  claim 6 , wherein determining the availability of monitoring resources within the device further comprises analyzing an average load of the resources of the device over a period of time. 
     
     
       10. The device of  claim 6 , wherein the generating the monitoring policy for the device further comprises determining a monitoring threshold for selective monitoring of fewer than all of the multiple tasks in which the monitoring threshold includes a threshold security monitoring importance score. 
     
     
       11. A non-transitory computer-readable medium that includes instructions that, in response to execution by one or more processors, are configured to cause the one or more processors to perform operations, the operations comprising:
 generating a monitoring importance score for each respective task of multiple tasks executing on a device based on one or more security attributes that correspond to the respective task in which each security monitoring importance score indicates a security risk of the respective task to the device; 
 determining an availability of a plurality of monitoring resources within the device that are used in monitoring the multiple tasks for security threats; 
 generating a monitoring policy for the device based at least in part on the security monitoring importance scores for the multiple tasks and the availability of monitoring resources within the device, the monitoring policy dictating selective monitoring of the multiple tasks for security threats according to a prioritization of the multiple tasks that is based on the respective security monitoring importance scores for the respective tasks of the multiple tasks in which the monitoring policy dictates the selective monitoring in response to the availability of monitoring resources of the device being insufficient to monitor all of the multiple tasks executing on the device; and 
 selectively monitoring fewer than all of the multiple tasks executing on the device for security threats according to the prioritization included in the monitoring policy. 
 
     
     
       12. The non-transitory computer-readable medium of  claim 11 , wherein the one or more security attributes include one or more attributes selected from a group of attributes consisting of: an execution duration of each of the multiple tasks, a security context of each of the multiple tasks, a level of permissions for a user of each of the multiple tasks, and a quantity of external interfaces to each of the multiple tasks. 
     
     
       13. The non-transitory computer-readable medium of  claim 11 , wherein the generating the security monitoring importance score for each respective task further comprises applying weights to the one or more attributes to generate the security monitoring importance score. 
     
     
       14. The non-transitory computer-readable medium of  claim 11 , wherein determining the availability of monitoring resources within the device further comprises analyzing an average load of the resources of the device over a period of time. 
     
     
       15. The non-transitory computer-readable medium of  claim 11 , wherein the generating the monitoring policy for the device further comprises determining a monitoring threshold for selective monitoring fewer than all of the multiple tasks in which the monitoring threshold includes a threshold security monitoring importance score.